CVE-2026-86710 Overview
CVE-2026-86710 is an authentication bypass vulnerability in the Login with QR WordPress plugin through version 1.0.0. The plugin fails to verify that a submitted login code was actually issued by the plugin itself. Instead, it matches the supplied code against any stored user metadata value. An unauthenticated attacker can exploit this flaw to log in as any user, including administrators. The weakness maps to [CWE-287: Improper Authentication].
Critical Impact
Unauthenticated attackers can gain administrator access to affected WordPress sites, resulting in full site compromise.
Affected Products
- Login with QR WordPress plugin, all versions through 1.0.0
- WordPress sites with the plugin installed and activated
- Any WordPress deployment relying on this plugin for authentication
Discovery Timeline
- 2026-09-17 - CVE-2026-86710 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-86710
Vulnerability Analysis
The Login with QR plugin implements a QR-based login workflow. When a user scans a code, the plugin receives a value and looks up the associated account. The intended design issues a unique, short-lived code bound to a specific authentication attempt.
The plugin does not confirm that the received code originated from its own issuance process. Instead, it queries the WordPress user metadata store and accepts any match. Because user metadata contains many attacker-guessable or discoverable values, this check is not a meaningful authentication decision.
A remote attacker can send crafted values to the plugin's login endpoint without prior authentication. On a successful match, the plugin authenticates the attacker as the corresponding WordPress user. Selecting an administrator account yields full control of the site.
Root Cause
The root cause is missing verification that a submitted credential was issued by the authentication mechanism. The plugin conflates possession of any user metadata value with proof of a legitimate authentication challenge. This is a classic broken authentication pattern under [CWE-287].
Attack Vector
The vulnerability is exploitable over the network with no authentication, no user interaction, and low complexity. An attacker interacts with the plugin's public login endpoint and supplies values until one matches stored user metadata. Refer to the WPScan Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-86710
Indicators of Compromise
- Unexpected successful logins to administrator or high-privilege accounts from unfamiliar IP addresses.
- New WordPress administrator accounts, plugin installations, or theme edits that do not correspond to authorized changes.
- Requests to the Login with QR plugin's authentication endpoint from clients that never enrolled a QR credential.
Detection Strategies
- Audit WordPress wp_users and wp_usermeta tables for accounts created or modified outside expected change windows.
- Review web server access logs for anomalous POST traffic to the plugin's login handler, particularly repeated requests with varying parameter values.
- Correlate authentication events with source IP reputation and geolocation to surface improbable logins.
Monitoring Recommendations
- Enable WordPress authentication logging and forward events to a centralized log platform for retention and analysis.
- Alert on privilege changes, new administrator role assignments, and plugin or theme file modifications.
- Monitor outbound connections from the WordPress host for signs of post-exploitation activity such as webshell callbacks.
How to Mitigate CVE-2026-86710
Immediate Actions Required
- Deactivate and remove the Login with QR plugin from all WordPress installations until a fixed version is available.
- Force a password reset for all WordPress accounts, prioritizing administrator and editor roles.
- Rotate WordPress secret keys and salts in wp-config.php and invalidate existing sessions.
- Review installed plugins, themes, and user accounts for unauthorized additions or modifications.
Patch Information
No fixed version is identified in the available advisory data. The plugin is reported vulnerable through version 1.0.0. Monitor the WPScan Vulnerability Report and the plugin's WordPress.org page for a vendor patch. Until a verified fix is published, removal is the recommended remediation.
Workarounds
- Block public access to the plugin's login endpoint at the web application firewall or reverse proxy layer.
- Restrict access to /wp-admin and authentication endpoints by source IP allowlisting where feasible.
- Enforce multi-factor authentication for all WordPress users using a separate, trusted plugin.
# Configuration example: disable the plugin via WP-CLI on affected hosts
wp plugin deactivate login-with-qr --all
wp plugin delete login-with-qr
# Rotate WordPress salts after removal
wp config shuffle-salts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
